diff --git a/.gitignore b/.gitignore
index 0987d85..9aef5aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,4 @@
 /openjdk-jdk17u-jdk-17.0.3+7.tar.xz
 /openjdk-jdk17u-jdk-17.0.4+1.tar.xz
 /openjdk-jdk17u-jdk-17.0.4+7.tar.xz
+/openjdk-jdk17u-jdk-17.0.4+8.tar.xz
diff --git a/NEWS b/NEWS
index 797c2d2..0a1d468 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,16 @@ Live versions of these release notes can be found at:
   * https://bitly.com/openjdk1704
   * https://builds.shipilev.net/backports-monitor/release-notes-17.0.4.txt
 
+* Security fixes
+  - JDK-8272243: Improve DER parsing
+  - JDK-8272249: Better properties of loaded Properties
+  - JDK-8273056, JDK-8283875, CVE-2022-21549: java.util.random does not correctly sample exponential or Gaussian distributions
+  - JDK-8277608: Address IP Addressing
+  - JDK-8281859, CVE-2022-21540: Improve class compilation
+  - JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
+  - JDK-8283190: Improve MIDI processing
+  - JDK-8284370: Improve zlib usage
+  - JDK-8285407, CVE-2022-34169: Improve Xalan supports
 * Other changes
   - JDK-8139173: [macosx] JInternalFrame shadow is not properly drawn
   - JDK-8181571: printing to CUPS fails on mac sandbox app
@@ -57,7 +67,6 @@ Live versions of these release notes can be found at:
   - JDK-8272493: Suboptimal code generation around Preconditions.checkIndex intrinsic with AVX2
   - JDK-8272908: Missing coverage for certain classes in com.sun.org.apache.xml.internal.security
   - JDK-8272964: java/nio/file/Files/InterruptCopy.java fails with java.lang.RuntimeException: Copy was not interrupted
-  - JDK-8273056: java.util.random does not correctly sample exponential or Gaussian distributions
   - JDK-8273095: vmTestbase/vm/mlvm/anonloader/stress/oome/heap/Test.java fails with "wrong OOME"
   - JDK-8273139: C2: assert(f <= 1 && f >= 0) failed: Incorrect frequency
   - JDK-8273142: Remove dependancy of TestHttpServer, HttpTransaction, HttpCallback from open/test/jdk/sun/net/www/protocol/http/ tests
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 5a441bb..b44225e 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -356,8 +356,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
-%global rpmrelease      3
+%global buildver        8
+%global rpmrelease      1
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@@ -383,7 +383,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
@@ -475,7 +475,11 @@
 %endif
 
 # x86 is no longer supported
+%if 0%{?java_arches:1}
 ExclusiveArch:  %{java_arches}
+%else
+ExcludeArch: %{ix86}
+%endif
 
 # not-duplicated scriptlets for normal/debug packages
 %global update_desktop_icons /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
@@ -2600,6 +2604,12 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Fri Jul 22 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.8-1
+- Update to jdk-17.0.3.0+8
+- Update release notes to 17.0.3.0+8
+- Switch to GA mode for release
+- Exclude x86 where java_arches is undefined, in order to unbreak build
+
 * Fri Jul 22 2022 Jiri Vanek <gnu.andrew@redhat.com> - 1:17.0.4.0.7-0.3.ea
 - moved to build only on %%{java_arches}
 -- https://fedoraproject.org/wiki/Changes/Drop_i686_JDKs
diff --git a/sources b/sources
index 865c6f2..765b22b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-jdk17u-jdk-17.0.4+7.tar.xz) = ddc6823a8c7a8fd0d3a126aa0180876f32e24ba7e6e900bd1103b19661467296dc828e564d9f63378a57f1e06922cb083f3ede78858eab33b3a2e43570a32419
+SHA512 (openjdk-jdk17u-jdk-17.0.4+8.tar.xz) = 9b6bac353899501e5645cac0234455d5777d6d7c7f0ef5ca2487770be5953a7af578c735aece1b64d2a59cc9e93d735ecb3a4d693ef97ca4ca84595bdb0c8deb